Following [1]}, we consider the binary cross-entropy loss, setting \(h(z) = \log (1+e^z)\) , with the labels \(y\)  taking value in \(\lbrace 0,1\rbrace \)  and the classifier model \(f: \mathbb {R}^d \rightarrow \mathbb {R}\) . In the following, we assume that the model parameter \(\theta \in \Theta := \lbrace \theta : y_i f(x_i) + (y_i - 1) f(x_i) \ge 0 \text{ for all } i \in [n] \rbrace \) . Note that this set contains the set of all parameters with correct classifications of training samples (before applying NFM), since \( \lbrace \theta : 1_{\lbrace f(x_i) \ge 0\rbrace } = y_i \text{ for all } i \in [n] \rbrace  \subset \Theta \) . Therefore, the condition of \(\theta \in \Theta \)  is satisfied when the model classifies all labels correctly for the training data before applying NFM. Since, in practice, the training error often becomes zero in finite time, we study the effect of NFM on model robustness in the regime of \(\theta \in \Theta \) .
